PRIVACY POLICY

NOTICE

This Privacy Policy explains how CRESCO TECHNOLOGIES LTD collects, uses, stores, and shares your personal data when you use the Platform.

1. Introduction and Identity of the Data Controller

1.1 CRESCO TECHNOLOGIES LTD ("Company", "we", "us", or "our"), a company incorporated in the UAE under registration number 37097, is the data controller responsible for the processing of your personal data in connection with the digital platform (the "Platform").

1.2 This Privacy Policy ("Policy") describes what personal data we collect, for what purposes we use it, with whom we share it, how long we retain it, and what rights you have in relation to it. This Policy should be read together with the Platform's Terms of Use and Risk Disclosure Statement, which are incorporated by reference.

1.3 For any questions, concerns, or requests relating to this Policy, please contact us at:

Email: info@joincresco.com
Registered Address: 4391ResCo-Work05, Floor. 43, Addax Port Office Tower, Al Rayfa Street, Abu Dhabi, Al Reem Island, United Arab Emirates

2. Scope and Applicability

2.1 This Policy applies to all personal data processed by the Company in connection with: (i) your registration and maintenance of an account on the Platform; (ii) your completion of the investment profiling and onboarding questionnaire; (iii) the connection of accounts with supported brokers or custodians to the Platform; (iv) your interactions with relevant financial partners through the Platform; and (v) your browsing and use of the Platform's features and content.

2.2 This Policy does not govern processing carried out by independent financial partners, brokers, custodians or third-party verification providers under their own privacy frameworks. Identity verification and KYC/AML checks are carried out by designated third-party verification providers and relevant financial partners. Users are encouraged to review the privacy notices of those third parties.

3. Personal Data We Collect

3.1 Registration Data

When you create an account on the Platform, we collect:

– your email address, verified by a one-time confirmation code sent at the point of registration;
– your account password, stored as a salted, one-way password hash; and
– technical metadata associated with account creation, including device type, IP address, and timestamp.

3.2 Investment Profile and Onboarding Data

During the onboarding process, we collect the following categories of information as part of your Investment Profile:

– investment management preference (discretionary delegation or advisory approval);
– primary investment objective (e.g. capital preservation, income generation, long-term growth);
– investment time horizon;
– stated risk tolerance and behavioural risk preference, including your hypothetical response to a portfolio decline;
– level of overall investment experience and familiarity with specific product types, including equities, ETFs, bonds, derivatives, structured products, and alternative investments;
– the financial significance of the investment capital relative to your overall financial position;
– the approximate proportion of your total assets represented by the investment; and
– the primary source of investment funds (e.g. business income, employment income, investment returns, inheritance).

Identity verification and KYC/AML checks are carried out by designated third-party verification providers and relevant financial partners. Identity documents, facial images and biometric verification data are submitted directly to the verification provider and are not received or stored by Cresco. Cresco may receive limited verification status information and technical identifiers necessary to facilitate onboarding. Where required and authorised, verification records may be made available by the verification provider directly to the relevant financial partner, in accordance with applicable data protection requirements.

3.3 Portfolio and Transaction Data from Supported Brokers and Custodians

Where you connect an account with a supported broker or custodian, Cresco may access, process and securely store relevant portfolio and transaction information, including holdings, balances, transaction history, valuations and performance data, for portfolio reporting, analytics and related Platform features. Such data is obtained via authorised integrations and may not always reflect real-time market conditions. Cresco does not request or store your brokerage login password.

3.4 Usage and Technical Data

When you access and use the Platform, we automatically collect:

– IP address, browser type, and operating system;
– pages visited, features used, time spent on the Platform, and clickstream data;
– device identifiers and session information; and
– cookie and tracking data, as further described in Section 11 of this Policy.

3.5 Communications Data

If you contact our support team by email or through the live chat function on the Platform, we retain the content of your communications and associated metadata for the purpose of resolving your enquiry and maintaining an accurate record of our interactions.

4. Legal Basis for Processing

As a technology platform without a financial services license, the Company processes personal data on the following legal bases applicable to its role as a software and infrastructure provider. The Company does not rely on financial regulatory obligations (such as AML or KYC requirements) as a basis for data processing, as those obligations rest with the relevant regulated financial partners under applicable law.

Contractual necessity: Processing required to perform the agreement between you and the Company (i.e. the Terms of Use), including account creation, delivery of the investment profiling tool, display of connected portfolio data, and provision of AI-generated summaries. This is the primary legal basis for the majority of data processing carried out by the Company.

Legitimate interests: Processing undertaken to pursue the Company's legitimate business interests as a technology operator, including platform security and fraud prevention, detection of abuse, technical performance monitoring, and support of the commercial relationship with relevant financial partners -- provided such interests are not overridden by your rights and freedoms.

Consent: Processing for optional activities that require consent, including non-essential analytical and marketing cookies where applicable. We may also rely on consent for marketing communications where consent is the appropriate lawful basis. Where permitted by applicable law and appropriate in the circumstances, direct marketing may instead be based on legitimate interests, subject to applicable requirements and the right to object. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out prior to withdrawal.

5. Purposes of Processing

We process your personal data for the following specific purposes:

– Account creation and authentication: to register your account, verify your email address, and manage your login credentials.
– Investment profiling: to collect your investment preferences and generate an Investment Profile for use in onboarding and coordinating relevant financial partner services.
– Platform delivery and personalisation: to display your connected portfolio data, AI-generated summaries, financial partner information, and investment ideas relevant to your profile.
– Financial partner onboarding and service coordination: to provide relevant authorised financial partners with the information reasonably necessary for the financial product or service you select, its onboarding and ongoing servicing, where permitted under applicable data protection requirements.
– AI Summary generation: to produce anonymised portfolio analytics summaries using a third-party AI provider, for your informational use only.
– Customer support: to respond to your enquiries, resolve complaints, and maintain records of our interactions.
– Platform security and fraud prevention: to monitor for and detect unauthorised access, abuse, and security incidents.
– Compliance with applicable law: to comply with court orders, regulatory directions, or other legally binding obligations applicable to the Company in its capacity as a technology operator incorporated in the UAE.
– Marketing communications: to send Platform updates, newsletters and promotional content where permitted under applicable law and on an appropriate lawful basis, with an opportunity to opt out of marketing communications.

6. Sharing of Personal Data with Third Parties

6.1 Authorised Financial Partners

Where you request or activate an investment-related service, Cresco may make relevant Investment Profile information and permitted portfolio information available to the appropriately authorised financial partner involved in providing that service. Sharing is limited to information reasonably necessary for the selected product, onboarding and ongoing servicing, and is carried out on an applicable lawful basis. The relevant financial partner may process information under its own privacy notice and client agreement.

6.2 AI Provider (OpenAI)

Portfolio data is submitted to the OpenAI API for the purpose of generating AI Summaries. Prior to transmission, all data is anonymised: no personally identifiable information, account numbers, or individual-specific data is sent to OpenAI. The data is transmitted in the form of an anonymised portfolio description.

6.3 Supported Brokers and Custodians

Where you authorise the connection of a brokerage or custody account, Cresco receives permitted account and portfolio information through the applicable provider integration. The relevant broker or custodian processes your account data under its own terms and privacy notice. The information made available to Cresco depends on your authorisation and the capabilities of the relevant integration.

6.4 Cloud Infrastructure Provider

User account data and Platform operational data are hosted using Amazon Web Services (AWS). Cresco applies appropriate technical and organisational measures to protect personal data and uses contractual and security controls appropriate to the services involved. The location and transfer arrangements for data processing are addressed in Section 7.

6.5 Analytics and Marketing Tools

The Platform uses third-party analytics and marketing tools, which may include services such as Google Analytics and similar platforms. These tools may collect usage data through cookies and similar tracking technologies. Please refer to Section 11 of this Policy and the Platform's Cookie Policy for further details.

6.6 Legal and Regulatory Disclosure

We may disclose personal data to competent governmental, regulatory, or judicial authorities if required to do so by applicable law, regulation, court order, or binding regulatory direction, or if we reasonably believe that such disclosure is necessary to protect the rights, property, or safety of the Company, its users, or the public.

6.7 Corporate Transactions

In the event of a merger, acquisition, restructuring, or sale of all or substantially all of the Company's assets, personal data held by the Company may be transferred to the relevant successor entity, subject to that entity assuming obligations substantially equivalent to those set out in this Policy.

6.8 No Sale of Personal Data

Cresco does not sell, rent or license personal data to third parties for their unrelated independent purposes. Disclosures to authorised financial partners or service providers for services requested by users are described in this Policy and do not, by themselves, constitute a sale of personal data.

7. International Transfers of Personal Data

7.1 Depending on the location of Amazon Web Services infrastructure, third-party service providers and relevant financial partners, personal data may be transferred to or accessed from jurisdictions outside the Abu Dhabi Global Market (ADGM). Such transfers will be undertaken in accordance with applicable ADGM data protection requirements, including an applicable adequacy decision, appropriate safeguards or another permitted transfer mechanism, as relevant.

7.2 Independent financial partners process personal data in accordance with their own applicable legal and contractual requirements. Any disclosure of personal data by Cresco to a partner outside ADGM is subject to applicable data protection requirements and the safeguards or other transfer mechanisms required for that disclosure.

8. Data Retention

8.1 The Company retains your personal data for as long as your account remains active and for such further period as is necessary to fulfil the purposes described in this Policy or to comply with legal obligations applicable to the Company in its capacity as a technology operator incorporated in the UAE.

8.2 Upon closure or termination of your account, account data and Investment Profile information will be retained for a period of five (5) years, after which it will be securely deleted or irreversibly anonymised. This retention period reflects the Company's legitimate interests in defending potential claims and maintaining records of completed contractual relationships, and is consistent with standard commercial practice for technology platforms under UAE law.

8.3 Communications data and support records are retained for a period of five (5) years from the date of the relevant communication, unless a longer period is required for the resolution of a pending dispute or legal proceeding.

8.4 Usage and technical data collected through cookies and analytics tools is retained in accordance with the retention practices described in the Cookie Policy. Anonymised or aggregated analytics data may be retained indefinitely as it no longer constitutes personal data.

9. Data Security

9.1 The Company implements appropriate technical and organisational security measures designed to protect your personal data against unauthorised access, disclosure, alteration, loss, or destruction. These measures include encryption of data in transit and at rest, access control mechanisms, secure cloud infrastructure, and regular security assessments.

9.2 No method of data transmission or storage is entirely secure, and the Company cannot guarantee the absolute security of your personal data. In the event of a data security incident likely to result in a risk to your rights and interests, the Company will notify you and any relevant regulatory authority in accordance with applicable law.

9.3 You are responsible for maintaining the security of your account credentials. The Company strongly recommends the use of a strong, unique password and advises you not to share your credentials with any third party.

10. Your Rights in Respect of Your Personal Data

Subject to the conditions and limitations established by the ADGM and other applicable law, you have the following rights in relation to your personal data:

– Right of access: to request confirmation of whether we process personal data about you and, if so, to obtain a copy of that data together with supplementary information about our processing activities.
– Right to rectification: to request correction of any inaccurate or incomplete personal data we hold about you.
– Right to erasure: to request deletion of your personal data where it is no longer necessary for the purposes for which it was collected, subject to applicable retention obligations.
– Right to restriction of processing: to request that we limit the processing of your personal data in certain circumstances, for example while the accuracy of your data is contested.
– Right to data portability: to receive personal data you have provided to us in a structured, commonly used, and machine-readable format, where technically feasible.
– Right to object: to object to processing of your personal data where it is based on the legitimate interests of the Company, including for direct marketing purposes.
– Right to withdraw consent: where processing is based on your consent, to withdraw that consent at any time without affecting the lawfulness of prior processing.
– Right to lodge a complaint: You have the right to lodge a complaint with the ADGM Commissioner of Data Protection concerning the processing of your personal data.

To exercise any of the above rights, please submit a written request to info@joincresco.com. We will respond within thirty (30) calendar days of receipt, or within such shorter period as may be required by applicable law. We may request reasonable verification of your identity before processing your request.

11. Cookies, Analytics, and Marketing Communications

11.1 Use of Cookies

The Platform uses cookies and similar tracking technologies for the following purposes: (i) essential cookies required for the operation and security of the Platform; (ii) functional cookies that remember your preferences and settings; and (iii) analytical and marketing cookies used to understand how users interact with the Platform and to deliver relevant communications. A description of cookie categories and preference controls is set out in the Platform's separate Cookie Policy.

11.2 Non-Essential Cookies and Consent

Non-essential analytical and marketing cookies are placed only with your prior consent. You may manage your preferences through the consent management tool on the Platform and may withdraw consent at any time without affecting your ability to access core platform features.

11.3 Third-Party Analytics

The Platform may use third-party analytics services, which may include Google Analytics and similar tools. These services may process usage data on servers located outside the ADGM. Please refer to the respective third-party privacy policies for further information.

11.4 Marketing Communications

Cresco may send marketing communications where permitted under applicable law and on an appropriate lawful basis. You may opt out of marketing communications at any time by using the unsubscribe link in a marketing email or contacting us at info@joincresco.com. Essential account, security and service-related notifications are handled separately and are not treated as optional marketing communications.

12. Minors

The Platform is intended solely for use by individuals who are at least 18 years of age. The Company does not knowingly collect personal data from individuals under the age of 18. If we become aware that personal data has been collected from a minor, we will take prompt steps to delete such data and close the relevant account. If you believe that a minor has registered on the Platform, please notify us at info@joincresco.com.

13. Changes to This Privacy Policy

13.1 The Company reserves the right to update this Policy from time to time to reflect changes in our data processing practices, applicable law, or platform features. Where any amendment is material, we will notify you by email or by a prominent notice on the Platform at least ten (10) days before the amendment takes effect, except where a shorter period is required by law.

13.2 Your continued use of the Platform following the effective date of any revised Policy constitutes your acknowledgement of the update. If you do not agree to the revised Policy, you must cease using the Platform and request account closure in accordance with the Terms of Use.

14. Governing Law and Dispute Resolution

This Policy and any dispute arising out of or in connection with it shall be governed by and construed in accordance with the laws of the ADGM. Subject to any rights and remedies that cannot lawfully be restricted under applicable data protection laws, disputes arising out of or in connection with this Policy shall be subject to the exclusive jurisdiction of the ADGM Courts, in accordance with the dispute resolution provisions of the Terms of Use.

15. Contact Us

For any questions, concerns, or requests relating to this Privacy Policy or our data processing practices, please contact:

Data Controller: CRESCO TECHNOLOGIES LTD
Registered Address: 4391ResCo-Work05, Floor. 43, Addax Port Office Tower, Al Rayfa Street, Abu Dhabi, Al Reem Island, United Arab Emirates
Email: info@joincresco.com